Ransomware attacks are on the rise. Are you battle ready? 

What timeframe and approvals are needed for obtaining a specific amount of Bitcoin – or other cybercurrency – and what steps need to be taken?  If it takes time to obtain the coins before transferring them, the delay could give the targeted company valuable negotiating space.

Ransomware is a combination of political and for-profit hackers who are increasing the frequency, ransom prices and complexity of attacks. Delays when victims seek police or IT help may be punished by wiped data or denial-of-service escalation. In addition, hacker teams now focus on finding and disabling back-up or response plans as part of attack strategies.

Using encryption to paralyze IT systems for ransom has been around since the floppy disk era of the 1980s, but it has grown from mischief to moneymaker. Ransomware accelerated along with the Internet’s growth as software downloads grew commonplace and, after 2010, with the popularity of cryptocurrencies that are now the standard ransom payment platform. In the US alone, the frequency of ransomware attacks has risen by 200% between 2019 and 2021.

How much? 

Has your response team or board consulted with owners, local executives or global HQ about how much they can afford to lose (or to spend) on attacks? Are you measuring down-time in hours, days or gigabytes of data? Will cyber-insurance cover loss or disruption?

On average, only 8% of the organizations that paid a ransom recovered all their data and about 63% of respondents retrieved around half. Some organizations that are identified as payers, receive repeated attacks or a second, greater ransom demand from the initial attackers. These uncertainties make responses difficult without serious preparation.

Ransom payment is only part of the cost. Lost productivity and sales, data recovery and reputational damage are among other possible consequences. These are multi-dimensional challenges that affect decision making in both short-term crisis discussions and the longer-range vision for the organization.

Different offices or national locations will have unique vulnerabilities and price-sensitivity. There is no one-size-fits-all, even within the same industry or company.

Have we done this before? 

One industry estimate is that 58% of data backups fail during a restoration attempt. So, having a tested, proven response for IT systems allows for greater confidence in negotiation with hackers. When the German farm was hit again by an attack in 2021, it refused the ransomware demand thanks to offsite and secured data backup. Also, the General Data Protection Regulation had taken effect since the first incident, outlining company responsibilities in the event of a data loss or breach.

Has your organization been targeted before? The Verizon 2021 Data Breach Investigations Report suggests that 85% of successful cyber attacks use social engineering – via text, phone call and website, not just email phishing. These weakest links are humans deceived into revealing confidential data that may not be used until much later when combined with other details. Do your people share these experiences and know how to avoid this manipulation?

What has your experience been with law enforcement or peer organizations? Attacks can be investigated more effectively when officials have access to information and similar incidents and the cooperation of managers and executives. What is your company’s policy about disclosure to partners, customers and authorities – local and global? 

Just because you have seen other attacks or heard stories from partners, your experience is unique. Speed of response, cost of recovery, people and cash resources are specific to your situation. For example, you need to know the difference between a “wiperware” attack that intentionally destroys data and a hostage-taking ransomware that demands payment. Failure to pay in a “simple” attack (encryption) can lead to escalation (wiper) or destructive (XXXXX), so responses should be measured, cautious and have an outcome goal.

Are we prepared? 

Despite massive investments in cybersecurity, many organizations now operate differently than they did before the COVID-19 pandemic with remote teams, responding with reduced headcount and other factors. Senior managers often focus investments in prevention capabilities, meaning that response and recovery are still potential weaknesses. Every organization should know its risks and response just as it does for a fire drill, weather emergency or other possible disruption.

Preparation also means understanding future requirements, not just looking backwards. There are local cultural issues, for example the law in Singapore that allows small companies to hire “data-protection-as-a-service” to comply with that nation’s personal data protection law.

In Australia, a bill for mandatory ransomware reporting was submitted in early 2022. A similar bill, called the Cyber Incident Reporting Act (CIRA), was approved by the US Senate as part of a sweeping Strengthening American Cybersecurity Act of 2022. If approved, the plan would require companies to report ransomware attacks within 72 hours and notification of a ransomware payment within 24 hours.